connect-coen--en[.]pineapple[.]page

The domain connect-coen--en.pineapple.page was observed serving content with an HTTP 200 response and a page title of "Official Site® | Coinbase pro | Digital Asset Exchange*", explicitly referencing the Coinbase brand. The site was hosted on Vercel infrastructure, as indicated by the detected technologies Vercel and HSTS, and the SSL certificate was issued by Let’s Encrypt (R13). Network resolution points to IP address 216.150.16.1, which belongs to Amazon.com, Inc. (AS16509) and is geolocated to the United States. Registration details list Vercel Inc. as the registrar, consistent with the hosting provider.

The domain triggered multiple defensive mechanisms: it is listed on PhishDestroy’s blocklist and appears on a single additional security blocklist, and Google Safe Browsing flags it for social engineering. VirusTotal analysis recorded 15 detections out of 95 scanned security vendors, reflecting a moderate consensus among scanners that the domain is malicious. Reputation services provide extremely low trust scores—Scamadviser 1/100 and Gridinsoft 0/100—reinforcing the assessment of a high‑risk crypto‑related scam. The site’s status is currently offline, but the historical evidence confirms a brand‑impersonation campaign targeting Coinbase users.

Defenders should continue to block the domain at network perimeter devices, update URL filtering feeds with the observed indicator, and monitor for any resurgence of the same host or similar Vercel‑based deployments. Incident response teams should also audit internal logs for connections to 216.150.16.1 and correlate any authentication attempts to Coinbase services with this indicator. The combination of brand‑specific page title, Vercel hosting, Amazon‑owned IP space, and multiple vendor detections provides a reliable signature for detection and remediation.